5 ms·

> I don’t have any good solutions here. The solution is for state actors to move their resources from offense to defense. Imagine half of the NSA budget going

> I don’t have any good solutions here. The solution is for state actors to move their resources from offense to defense. Imagine half of the NSA budget going into auditing software, both closed source and open source. (They already do that, but AFAIK nowhere near half.) There is a quite clear and simple line here: the people breaking security for any purpose other than fixing security problems are the "baddies", and the people defending systems are the "goodies". If some intelligence service decides they want to covertly exploit security issues, they have made their choice to be "baddies" and should be treated as such. (Coincidentally, this narrative of "XYZ got hacked by ABC hackers, bad ABC!" needs to change to "XYZ got hacked, bad IT sec at XYZ!" - it's your choice to plug your shit into the internet, and your responsibility to make sure you don't get 0wned.)

tgragnato 6y ago
> XYZ got hacked, bad IT sec at XYZ In this particular case I can't follow this part of the reasoning. It was a counterterrorism operation using sophisticated exploit chains. Would you clarify what's the bad IT sec? "nobody should use a browser"? https://1.bp.blogspot.com/-37hyk7hERGk/YFDuISGgCNI/AAAAAAAAaww/xcrVLfY_ZUQVozcte09NaqafWbL8ukvDgCNcBGAsYHQ/s1660/image1%2B%25282%2529.png https://1.bp.blogspot.com/-37hyk7hERGk/YFDuISGgCNI/AAAAAAAAa...
- eqvinox 6y ago
  I was trying to make an independent point with that "coincidentally ...", sorry if that was a bit unclear. In this case, the takeaway would be "we still don't know how to make secure browsers even though we're trying our darndest." But also, that exploit chain is limited to a single machine; there's still some opportunity to limit damages on a larger scale.
- iforgotpassword 6y ago
  That's a bit extreme, but I find it worrying how the general public seems to have accepted that software just has bugs. Like it's this self conscious thing and nobody is at fault. Prisoners don't get released although they served their sentence? Software fault. People pay more tax thab they should? Software bug! Let's just shrug im confusion about that silly software problems that nobody os possibly responsible for.
  - ben_w 6y ago
    Most people understand computers in the same way I “understand” law, the armed forces, and medicine: via Hollywood. This naturally leads to a chronic gap between the state of reality and belief about the state of reality.
bostonsre 6y ago
Only playing defense won't work for nation states due to similar thought processes of mutually assured destruction. If you're enemy has a bigger and scarier gun, it puts you at a disadvantage in geo politics. Also, I'm not sure the clear line is that clear. There will almost always be a tipping point for people for this type of scenario. If the hacking operation that was exposed would have prevented an attack that kills 1 person, was it still OK to expose? 100 people? 10,000? It's almost impossible to know what the exposure cost will be but if people die due to it and it becomes known, some people will rethink what the "right" thing to do was. This type of stuff seems like it should be decided by elected representatives and not by some team of coders that work for some for profit company. It seems possible to me that the decision they made was based purely on what was best for Google. I think we as tech workers need to acknowledge and understand the viewpoints contrary to ours and try to compromise with those on the other side. This type of issue is complex and I think we really need to acknowledge that there is no easy "right" solution to something like this. Blind idealism on both sides of the issue won't be good for either side or for society in general. We as tech workers are not infallible and we don't deserve to dictate rules to society just because we know how to write code.
- eqvinox 6y ago
  > [...] mutually assured destruction [...] But that's exactly what this is not. Every big and scary gun the enemy might have is also a big and scary vulnerability that you could fix. While it's infeasible to have "perfect" security, you can absolutely make the enemy's offensive tools useless. It's especially bad since when working offensively, you're incentivized to not fix issues. That might be OK for black hats & nations with "questionable" ethics, but how is this a thing in any democratic country? When state agencies are sitting on exploits and purposely not working to get them fixed, that's IMHO a kind of treason on your own country. It's leaving entry points open for others to find. And anything you can find, they can find too. > Also, I'm not sure the clear line is that clear. [...] prevented an attack that kills 1 person, was it still OK to expose? 100 people? 10,000? [...] The line is clear, because that attack that the "goodie" western hackers couldn't execute, and possibly resulted in deaths, might as well be an attack that the "baddie" hackers couldn't execute, resulting in people surviving. Systems are generally designed such that working correctly is the intended best state (even for weapons support systems.) More work going towards keeping systems within their design parameters (i.e. not hacked) should be the best way to save lives. Even if we're talking about some terrorist building a computerized IED, there are likely systems whose correct functioning can help save lives - maybe some chemical detectors at an airport, or first responder management systems, etc. It's also the only line that can be drawn on an objective standard. Regardless of whether you're the USA, EU, China, or North Korea - "systems functioning correctly to their design" is an universal standard. Do you think North Korea cares about any life that isn't their bonzo supreme leader?
robomartin 6y ago
Have you ever played a purely defensive game of chess? Not a perfect analogy, of course, yet a good demonstration that your opponent will eventually get in. You only have to make one mistake and you have nothing to counter with. In that context (chess) the final evaluation reveals a well executed attack is superior to a defensive stance. I suspect the same is true of espionage and war. In other words, stop them before they have the opportunity to get to your king. Another hypothetical: Imagine a future event when, for whatever reason, a band of twenty criminals is intent on breaking into one hundred homes in your neighborhood. The twist is: You can’t call the police for help. Which decision would lead to securing these homes: Each family stays in their home to defend it or one hundred neighbors join forces to repel them?

tgragnato 6y ago

> XYZ got hacked, bad IT sec at XYZ In this particular case I can't follow this part of the reasoning. It was a counterterrorism operation using sophisticated exploit chains. Would you clarify what's the bad IT sec? "nobody should use a browser"? https://1.bp.blogspot.com/-37hyk7hERGk/YFDuISGgCNI/AAAAAAAAaww/xcrVLfY_ZUQVozcte09NaqafWbL8ukvDgCNcBGAsYHQ/s1660/image1%2B%25282%2529.png https://1.bp.blogspot.com/-37hyk7hERGk/YFDuISGgCNI/AAAAAAAAa...

eqvinox 6y ago
I was trying to make an independent point with that "coincidentally ...", sorry if that was a bit unclear. In this case, the takeaway would be "we still don't know how to make secure browsers even though we're trying our darndest." But also, that exploit chain is limited to a single machine; there's still some opportunity to limit damages on a larger scale.
iforgotpassword 6y ago
That's a bit extreme, but I find it worrying how the general public seems to have accepted that software just has bugs. Like it's this self conscious thing and nobody is at fault. Prisoners don't get released although they served their sentence? Software fault. People pay more tax thab they should? Software bug! Let's just shrug im confusion about that silly software problems that nobody os possibly responsible for.
- ben_w 6y ago
  Most people understand computers in the same way I “understand” law, the armed forces, and medicine: via Hollywood. This naturally leads to a chronic gap between the state of reality and belief about the state of reality.

bostonsre 6y ago

Only playing defense won't work for nation states due to similar thought processes of mutually assured destruction. If you're enemy has a bigger and scarier gun, it puts you at a disadvantage in geo politics. Also, I'm not sure the clear line is that clear. There will almost always be a tipping point for people for this type of scenario. If the hacking operation that was exposed would have prevented an attack that kills 1 person, was it still OK to expose? 100 people? 10,000? It's almost impossible to know what the exposure cost will be but if people die due to it and it becomes known, some people will rethink what the "right" thing to do was. This type of stuff seems like it should be decided by elected representatives and not by some team of coders that work for some for profit company. It seems possible to me that the decision they made was based purely on what was best for Google. I think we as tech workers need to acknowledge and understand the viewpoints contrary to ours and try to compromise with those on the other side. This type of issue is complex and I think we really need to acknowledge that there is no easy "right" solution to something like this. Blind idealism on both sides of the issue won't be good for either side or for society in general. We as tech workers are not infallible and we don't deserve to dictate rules to society just because we know how to write code.

eqvinox 6y ago
> [...] mutually assured destruction [...] But that's exactly what this is not. Every big and scary gun the enemy might have is also a big and scary vulnerability that you could fix. While it's infeasible to have "perfect" security, you can absolutely make the enemy's offensive tools useless. It's especially bad since when working offensively, you're incentivized to not fix issues. That might be OK for black hats & nations with "questionable" ethics, but how is this a thing in any democratic country? When state agencies are sitting on exploits and purposely not working to get them fixed, that's IMHO a kind of treason on your own country. It's leaving entry points open for others to find. And anything you can find, they can find too. > Also, I'm not sure the clear line is that clear. [...] prevented an attack that kills 1 person, was it still OK to expose? 100 people? 10,000? [...] The line is clear, because that attack that the "goodie" western hackers couldn't execute, and possibly resulted in deaths, might as well be an attack that the "baddie" hackers couldn't execute, resulting in people surviving. Systems are generally designed such that working correctly is the intended best state (even for weapons support systems.) More work going towards keeping systems within their design parameters (i.e. not hacked) should be the best way to save lives. Even if we're talking about some terrorist building a computerized IED, there are likely systems whose correct functioning can help save lives - maybe some chemical detectors at an airport, or first responder management systems, etc. It's also the only line that can be drawn on an objective standard. Regardless of whether you're the USA, EU, China, or North Korea - "systems functioning correctly to their design" is an universal standard. Do you think North Korea cares about any life that isn't their bonzo supreme leader?

robomartin 6y ago

Have you ever played a purely defensive game of chess? Not a perfect analogy, of course, yet a good demonstration that your opponent will eventually get in. You only have to make one mistake and you have nothing to counter with. In that context (chess) the final evaluation reveals a well executed attack is superior to a defensive stance. I suspect the same is true of espionage and war. In other words, stop them before they have the opportunity to get to your king. Another hypothetical: Imagine a future event when, for whatever reason, a band of twenty criminals is intent on breaking into one hundred homes in your neighborhood. The twist is: You can’t call the police for help. Which decision would lead to securing these homes: Each family stays in their home to defend it or one hundred neighbors join forces to repel them?